test(auth): add JWT claims expiration and trusted issuer validation specs

[gcoinstash-cmd]

Summary

Adds unit test specifications verifying JWT authentication claims lifecycle expiration checks and issuer whitelist validation guards in lily-backend.

• Asserts token temporal validity invariants (iat <= now < exp).
• Enforces strict whitelist evaluation on authentication token issuers.

Closes backend authentication security test coverage.